{ "document_version": "1.0-draft-1", "wire_version": "1.0", "certified_profiles": [], "profiles": [ { "role": "provider", "name": "Core", "checks": [ "CORE-01", "PAIR-01", "DISC-01", "TEMP-01", "TEMP-02", "TEMP-03", "SIGN-01", "CONSENT-01", "LOG-01", "LOG-02", "KEY-01", "PURGE-01", "CLAIM-01", "TRANSPORT-01", "WIRE-01", "OAUTH-01", "FETCH-01", "INFER-01", "PRIVACY-01", "PRIVACY-02", "PRIVACY-03", "PRIVACY-04", "PRIVACY-05", "PRIVACY-06" ] }, { "role": "provider", "name": "Write", "requires": [ "Core" ], "checks": [ "CONTRIB-01", "CONTRIB-02", "CONTRIB-03" ] }, { "role": "provider", "name": "Portable", "requires": [ "Core" ], "checks": [ "PORT-01", "MIGRATE-01" ] }, { "role": "provider", "name": "Delegated", "requires": [ "Core" ], "checks": [ "DELEGATE-01" ] }, { "role": "recipient", "name": "Read", "checks": [ "CORE-01", "DISC-01", "TEMP-03", "SIGN-01", "PURGE-01", "CLAIM-01", "TRANSPORT-01", "WIRE-01", "FETCH-01", "PRIVACY-01", "PRIVACY-02", "PRIVACY-03", "PRIVACY-04", "PRIVACY-05", "PRIVACY-06" ] }, { "role": "recipient", "name": "Contribute", "checks": [ "CONSENT-01", "CONTRIB-01", "CONTRIB-02", "CLAIM-01", "WIRE-01", "FETCH-01", "PRIVACY-01", "PRIVACY-02", "PRIVACY-03", "PRIVACY-04", "PRIVACY-05", "PRIVACY-06" ] }, { "role": "recipient", "name": "Reciprocal", "requires": [ "Read", "Contribute" ], "checks": [ "PORT-01", "CLAIM-01" ] } ], "optional_features": [ { "name": "advertising", "checks": [ "ADS-01", "ADS-02" ] }, { "name": "public-handles", "checks": [ "HANDLE-01" ] }, { "name": "encrypted-export", "checks": [ "ENCRYPT-01" ] }, { "name": "pdpp-binding", "checks": [ "BINDING-01" ] } ], "checks": [ { "id": "PRIVACY-01", "section": "A16.2/A16.8", "requirement": "Deployment-specific applicability, actual roles, lawful conditions, notices and consent evidence before processing; unresolved uses disabled.", "runtime_evidence": "pending", "pending_phase": "V12" }, { "id": "PRIVACY-02", "section": "A16.3/A16.8", "requirement": "Local sensitivity, inference and necessity assessment; prohibited categories and further uses stay disabled despite grant consent.", "runtime_evidence": "pending", "pending_phase": "V12" }, { "id": "PRIVACY-03", "section": "A16.4/A16.8", "requirement": "Document every international flow and its required safeguards before enabling it; reassess changed destinations and suspend unsupported flows.", "runtime_evidence": "pending", "pending_phase": "V12" }, { "id": "PRIVACY-04", "section": "A16.5/A16.8", "requirement": "Exercise rights, local deadlines, correction, bounded retention, backup restoration, legal holds and recipient deletion follow-up.", "runtime_evidence": "pending", "pending_phase": "V12" }, { "id": "PRIVACY-05", "section": "A16.6/A16.8", "requirement": "Enforce applicable opt-outs and preference signals after grant issue; advertising and child processing disabled without required safeguards.", "runtime_evidence": "pending", "pending_phase": "V12" }, { "id": "PRIVACY-06", "section": "A16.7/A16.8", "requirement": "Evidence required governance and granted, in-scope regulatory permissions with expiry/renewal controls; incident exercises, local deadlines, decision rights and regulatory status.", "runtime_evidence": "pending", "pending_phase": "V12" }, { "id": "CORE-01", "section": "A3/A6", "requirement": "No read without a currently active, audience-bound grant; test revocation and exhausted counters under concurrency.", "runtime_evidence": "pending", "pending_phase": "V4" }, { "id": "PAIR-01", "section": "A3", "requirement": "Different clients receive different handles and entry aliases; rotation changes both; no canonical identifiers escape.", "runtime_evidence": "pending", "pending_phase": "V4" }, { "id": "DISC-01", "section": "A5", "requirement": "Intersect restrictions, sparse levels, approved text, no omission counters, no identifiers below their allowed level.", "runtime_evidence": "library", "pending_phase": "V4" }, { "id": "TEMP-01", "section": "A4", "requirement": "Before/start/end/after, null bounds, invalid intervals and independent grant expiry using one Clock instant.", "runtime_evidence": "library", "pending_phase": "V4" }, { "id": "TEMP-02", "section": "A4", "requirement": "Explicit activation and conflict selection; baseline restores; standing safety facts survive.", "runtime_evidence": "library", "pending_phase": "V4" }, { "id": "TEMP-03", "section": "A5/B4", "requirement": "Dependencies, cached and conditional responses cannot outlive source or grant rights.", "runtime_evidence": "library", "pending_phase": "V4" }, { "id": "SIGN-01", "section": "A5/A15", "requirement": "Tampering, duplicate members and non-I-JSON, untrusted or unknown keys, other algorithms, critical headers, wrong types, objects naming another issuer and expired signed objects are rejected.", "runtime_evidence": "library", "pending_phase": "V4", "vectors": [ "vectors/jcs.json", "vectors/disclosure.json", "vectors/receipt.json", "vectors/purge.json", "vectors/negative.json" ] }, { "id": "CONSENT-01", "section": "A2/A6", "requirement": "Separate read/contribute grants, purpose changes need approval, recipient flags cannot authorise, and every client that is neither an assistant nor classified by the operator is shown as unverified.", "runtime_evidence": "pending", "pending_phase": "V3" }, { "id": "ADS-01", "section": "A6", "requirement": "Default off; eligible adult-owned confirmed enum keys only; max L1, one read, 24 hours, no retention or delegation.", "runtime_evidence": "library", "pending_phase": "V4" }, { "id": "ADS-02", "section": "A6/A9", "requirement": "Receipts and withdrawal evidence; no implied onward right or linkage to other recipients.", "runtime_evidence": "pending", "pending_phase": "V9" }, { "id": "CONTRIB-01", "section": "A14", "requirement": "Write-only cannot read; read-only cannot write; declarations require exact confirmation.", "runtime_evidence": "pending", "pending_phase": "V9" }, { "id": "CONTRIB-02", "section": "A14", "requirement": "Origin, retry, collision, correction/withdrawal, tombstones, revoked retries, atomic acknowledgements and 90-day suppression of rejected suggestions.", "runtime_evidence": "library", "pending_phase": "V9" }, { "id": "CONTRIB-03", "section": "A4/A14", "requirement": "Raw history and preferences separately selected; recursively enforce actual dependency field rights.", "runtime_evidence": "library", "pending_phase": "V9" }, { "id": "LOG-01", "section": "A9", "requirement": "Counter, receipt and disclosure commit atomically; non-read events carry the subject, actor, decision and IDs A9 gives their kind; verify chain; operational logs contain no entry values.", "runtime_evidence": "pending", "pending_phase": "V4", "vectors": [ "vectors/receipt.json", "vectors/negative.json" ] }, { "id": "LOG-02", "section": "A9", "requirement": "A receipt signed before a key rotation verifies afterwards from the published keys and the owner export alone.", "runtime_evidence": "pending", "pending_phase": "V4", "vectors": [ "vectors/receipt.json", "vectors/negative.json" ] }, { "id": "KEY-01", "section": "A9/A5", "requirement": "Key IDs are canonical RFC 7638 thumbprints, never reused and never shared between providers; a retired key signs nothing at or after its exp, stays published with an exp that never changes, and verifiers reject signatures dated at or after it.", "runtime_evidence": "integration", "pending_phase": "V2", "vectors": [ "vectors/keys.json", "vectors/disclosure.json", "vectors/receipt.json", "vectors/negative.json" ] }, { "id": "PURGE-01", "section": "A10", "requirement": "Grant ending stops reads, signed notices retry/poll, acks and missing deadlines visible; no why leakage.", "runtime_evidence": "pending", "pending_phase": "V9", "vectors": [ "vectors/purge.json", "vectors/negative.json" ] }, { "id": "PORT-01", "section": "A11", "requirement": "Two-way round trip, temporal/provenance preservation, unsupported report, the A4.1 entry limit of each partition checked before any change, no executable imported authority.", "runtime_evidence": "pending", "pending_phase": "V10" }, { "id": "CLAIM-01", "section": "A17", "requirement": "Role/version/category/evidence bound claims; no certification or full portability from schema checks alone.", "runtime_evidence": "pending", "pending_phase": "V8" }, { "id": "DELEGATE-01", "section": "A6", "requirement": "Target-bound, one-use five-minute offers redeemed only by a recipient that authenticates with private_key_jwt; parent/child restrictions and revocation checked atomically.", "runtime_evidence": "pending", "pending_phase": "V9" }, { "id": "TRANSPORT-01", "section": "A7/A8/B3/B4", "requirement": "REST/MCP return the same signed object; headers, DPoP, audience, limits and errors match contracts.", "runtime_evidence": "pending", "pending_phase": "V4" }, { "id": "WIRE-01", "section": "A1.1/A4.1", "requirement": "Unknown members, values outside their key's closed schema and keys outside the negotiated core vocabulary are rejected at every defined wire boundary; there is no arbitrary-JSON entry lane.", "runtime_evidence": "pending", "pending_phase": "V4" }, { "id": "HANDLE-01", "section": "A3.2", "requirement": "Public handles follow the grammar and claim protections, and resolution yields no record contents, DID or existence evidence to unauthenticated enumeration.", "runtime_evidence": "pending", "pending_phase": "V10" }, { "id": "MIGRATE-01", "section": "A3.4/B4.3", "requirement": "After migration the old provider never redirects authenticated API or token requests, forwards credentials or reveals the destination; purge continues there until settled.", "runtime_evidence": "pending", "pending_phase": "V10" }, { "id": "INFER-01", "section": "A4.2/A14.3", "requirement": "Special-category and safety-critical keys are never observed or inferred and accept only user_supplied events, as protected proposals; inference for an inferable:false key fails inference_forbidden.", "runtime_evidence": "pending", "pending_phase": "V9" }, { "id": "OAUTH-01", "section": "A2/A6.1/A6.3/A6.5/A6.6/A6.8", "requirement": "Metadata naming the configured issuer, iss on responses, per-surface audiences and challenges, exact client-ID matching, registration metadata refused outside its schema, classes from registration evidence, never assistant with a loopback redirect URI, and their limits at issuance, PKCE S256 single-use codes, exact redirects, session-bound state, unframeable consent, DPoP proofs used once within 60 seconds at the token endpoint, rotating refresh whose reuse ends the grant, bounded access and lifecycle tokens, refresh-token revocation ending the grant, with proof of possession of the bound DPoP key from a public client, and access tokens refused as unsupported, and no authorisation, token or refresh for a suspended client.", "runtime_evidence": "pending", "pending_phase": "V3" }, { "id": "FETCH-01", "section": "A15.3/A3.3/A6.1", "requirement": "Every fetch of a client- or provider-supplied URL checks resolved addresses and each redirect, refuses private and link-local destinations unless an isolated local mode is configured, bounds size and time and forwards no credentials across origins.", "runtime_evidence": "pending", "pending_phase": "V3" }, { "id": "ENCRYPT-01", "section": "A11.2", "requirement": "Optional encrypted export uses the exact JWE and Argon2id parameters, rejects other parameters, duplicate members and excess size before deriving a key, bounds concurrent derivations, verifies GCM first and fails generically.", "runtime_evidence": "pending", "pending_phase": "V10" }, { "id": "BINDING-01", "section": "B1.2/B1.3/B1.11", "requirement": "The PDPP source declaration is generated from the vocabulary with source.id equal to the resource identifier; streams are static; owner record endpoints refuse every token.", "runtime_evidence": "pending", "pending_phase": "V3" }, { "id": "WILDCARD-01", "section": "A15.1", "requirement": "Recommended: a wildcard L0 grant is refused to a client already holding L2 or higher in any domain, and the person sees the actual selection.", "runtime_evidence": "pending", "pending_phase": "V3" }, { "id": "SCOPE-01", "section": "A6.2", "requirement": "The recovered proposal's A6.3 scope example round-trips exactly.", "runtime_evidence": "library", "pending_phase": "V3" }, { "id": "SCOPE-02", "section": "A6.2", "requirement": "Only the closed purposes and capabilities are accepted.", "runtime_evidence": "library", "pending_phase": "V3" }, { "id": "SCOPE-03", "section": "A6.2", "requirement": "Exactly one purpose is required.", "runtime_evidence": "library", "pending_phase": "V3" }, { "id": "SCOPE-04", "section": "A6.2", "requirement": "A wildcard grants only L0, with no implicit read permission.", "runtime_evidence": "library", "pending_phase": "V3" }, { "id": "SCOPE-05", "section": "A6.2", "requirement": "Duplicates collapse without losing declared-only restrictions.", "runtime_evidence": "library", "pending_phase": "V3" }, { "id": "SCOPE-06", "section": "A6.2", "requirement": "Malformed separators, non-string boundaries and unsupported tokens reject the whole scope.", "runtime_evidence": "library", "pending_phase": "V3" }, { "id": "SCOPE-07", "section": "A6.2", "requirement": "Input limits and unsafe domain lookups fail closed.", "runtime_evidence": "library", "pending_phase": "V3" }, { "id": "SCOPE-08", "section": "A6.2", "requirement": "10,000 arbitrary inputs expose only safe validation errors.", "runtime_evidence": "library", "pending_phase": "V3" }, { "id": "SCOPE-09", "section": "A6.2", "requirement": "10,000 generated valid sets round-trip and never elevate a ceiling.", "runtime_evidence": "library", "pending_phase": "V3" }, { "id": "SCOPE-10", "section": "A6.2/A6.7", "requirement": "Advertising is an explicit purpose and grants no implicit capability.", "runtime_evidence": "library", "pending_phase": "V3" }, { "id": "ID-01", "section": "A4.1", "requirement": "Only canonical prefixed identifiers are accepted, including ULID boundaries.", "runtime_evidence": "library", "pending_phase": "V4" }, { "id": "ID-02", "section": "A4.1", "requirement": "Generation uses the supplied clock and the library CSPRNG, without ambient time or Math.random.", "runtime_evidence": "library", "pending_phase": "V4" }, { "id": "ID-03", "section": "A4.1", "requirement": "Invalid generation input fails with fixed errors.", "runtime_evidence": "library", "pending_phase": "V4" }, { "id": "ID-04", "section": "A4.1", "requirement": "10,000 generated identifiers validate and preserve the supplied timestamp.", "runtime_evidence": "library", "pending_phase": "V4" }, { "id": "ID-05", "section": "A4.1", "requirement": "The public schema package runs in a browser with secure randomness and no ambient clock.", "runtime_evidence": "library", "pending_phase": "V4" }, { "id": "VOCAB-1.1-01", "section": "vocabulary", "requirement": "Approved additions are versioned without changing the semantics of older keys.", "runtime_evidence": "library", "pending_phase": "V4" }, { "id": "VOCAB-1.1-02", "section": "vocabulary", "requirement": "Closed enum values and text bounds are enforced.", "runtime_evidence": "library", "pending_phase": "V4" }, { "id": "VOCAB-1.1-03", "section": "vocabulary", "requirement": "New keys need both grant approval and recipient support, including at L0.", "runtime_evidence": "library", "pending_phase": "V4" }, { "id": "VOCAB-1.1-04", "section": "vocabulary", "requirement": "Always-do text needs an approved L1/L2 rendering and cannot be inferred.", "runtime_evidence": "library", "pending_phase": "V4" }, { "id": "VOCAB-1.1-05", "section": "vocabulary", "requirement": "Enum values render unchanged at L1 to L3 and use closed categories at L0.", "runtime_evidence": "library", "pending_phase": "V4" }, { "id": "VOCAB-1.1-06", "section": "vocabulary", "requirement": "Overlays, grant restrictions and independent revocation apply to all additions.", "runtime_evidence": "library", "pending_phase": "V4" }, { "id": "VOCAB-1.1-07", "section": "vocabulary", "requirement": "Unavailable key timing cannot change an older vocabulary response.", "runtime_evidence": "library", "pending_phase": "V4" }, { "id": "VOCAB-1.1-08", "section": "vocabulary", "requirement": "Generated synthetic pilot examples validate and new enum preferences remain inferable.", "runtime_evidence": "library", "pending_phase": "V4" }, { "id": "VOCAB-1.1-09", "section": "vocabulary", "requirement": "Transitive dependencies obey both versions without leaking unavailable-source timing.", "runtime_evidence": "library", "pending_phase": "V4" } ] }